docs: def convert_from_json(self, md, entityname, rsaprivatekey):
          # type: (EncryptionMetadata, dict, str,
          #        cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey)
          #        -> None
          """Read metadata json into objects
          :param EncryptionMetadata self: this
          :param dict md: metadata dictionary
          :param str entityname: entity name
          :param rsaprivatekey: RSA private key
          :type rsaprivatekey:
              cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey
          """
          # populate from encryption data
          ed = json.loads(md[EncryptionMetadata._METADATA_KEY_NAME])
          try:
              self.blobxfer_extensions = EncryptionBlobxferExtensions(
                  pre_encrypted_content_md5=ed[
                      EncryptionMetadata._JSON_KEY_BLOBXFER_EXTENSIONS][
                          EncryptionMetadata._JSON_KEY_PREENCRYPTED_MD5],
              )
          except KeyError:
              pass
          self.content_encryption_iv = base64.b64decode(
              ed[EncryptionMetadata._JSON_KEY_CONTENT_IV])
          self.encryption_agent = EncryptionAgent(
              encryption_algorithm=ed[
                  EncryptionMetadata._JSON_KEY_ENCRYPTION_AGENT][
                      EncryptionMetadata._JSON_KEY_ENCRYPTION_ALGORITHM],
              protocol=ed[
                  EncryptionMetadata._JSON_KEY_ENCRYPTION_AGENT][
                      EncryptionMetadata._JSON_KEY_PROTOCOL],
          )
          if (self.encryption_agent.encryption_algorithm !=
                  EncryptionMetadata._ENCRYPTION_ALGORITHM):
              raise RuntimeError('{}: unknown block cipher: {}'.format(
                  entityname, self.encryption_agent.encryption_algorithm))
          if (self.encryption_agent.protocol !=
                  EncryptionMetadata._ENCRYPTION_PROTOCOL_VERSION):
              raise RuntimeError('{}: unknown encryption protocol: {}'.format(
                  entityname, self.encryption_agent.protocol))
          self.encryption_authentication = EncryptionAuthentication(
              algorithm=ed[
                  EncryptionMetadata._JSON_KEY_INTEGRITY_AUTH][
                      EncryptionMetadata._JSON_KEY_ALGORITHM],
              message_authentication_code=ed[
                  EncryptionMetadata._JSON_KEY_INTEGRITY_AUTH][
                      EncryptionMetadata._JSON_KEY_MAC],
          )
          if (self.encryption_authentication.algorithm !=
                  EncryptionMetadata._AUTH_ALGORITHM):
              raise RuntimeError(
                  '{}: unknown integrity/auth method: {}'.format(
                      entityname, self.encryption_authentication.algorithm))
          self.encryption_mode = ed[
              EncryptionMetadata._JSON_KEY_ENCRYPTION_MODE]
          if self.encryption_mode != EncryptionMetadata._ENCRYPTION_MODE:
              raise RuntimeError(
                  '{}: unknown encryption mode: {}'.format(
                      entityname, self.encryption_mode))
          try:
              _eak = ed[EncryptionMetadata._JSON_KEY_WRAPPEDCONTENTKEY][
                  EncryptionMetadata._JSON_KEY_ENCRYPTED_AUTHKEY]
          except KeyError:
              _eak = None
          self.wrapped_content_key = EncryptionWrappedContentKey(
              algorithm=ed[
                  EncryptionMetadata._JSON_KEY_WRAPPEDCONTENTKEY][
                      EncryptionMetadata._JSON_KEY_ALGORITHM],
              encrypted_authentication_key=_eak,
              encrypted_key=ed[
                  EncryptionMetadata._JSON_KEY_WRAPPEDCONTENTKEY][
                      EncryptionMetadata._JSON_KEY_ENCRYPTED_KEY],
              key_id=ed[
                  EncryptionMetadata._JSON_KEY_WRAPPEDCONTENTKEY][
                      EncryptionMetadata._JSON_KEY_KEYID],
          )
          if (self.wrapped_content_key.algorithm !=
                  EncryptionMetadata._ENCRYPTED_KEY_SCHEME):
              raise RuntimeError('{}: unknown key encryption scheme: {}'.format(
                  entityname, self.wrapped_content_key.algorithm))
          # if RSA key is a public key, stop here as keys cannot be decrypted
          if rsaprivatekey is None:
              return
          # decrypt symmetric key
          self._symkey = blobxfer.operations.crypto.\
              rsa_decrypt_base64_encoded_key(
                  rsaprivatekey, self.wrapped_content_key.encrypted_key)
          # decrypt signing key, if it exists
          if blobxfer.util.is_not_empty(
                  self.wrapped_content_key.encrypted_authentication_key):
              self._signkey = blobxfer.operations.crypto.\
                  rsa_decrypt_base64_encoded_key(
                      rsaprivatekey,
                      self.wrapped_content_key.encrypted_authentication_key)
          else:
              self._signkey = None
          # populate from encryption data authentication
          try:
              eda = json.loads(md[EncryptionMetadata._METADATA_KEY_AUTH_NAME])
          except KeyError:
              pass
          else:
              self.encryption_metadata_authentication = \
                  EncryptionMetadataAuthentication(
                      algorithm=eda[
                          EncryptionMetadata._JSON_KEY_AUTH_METAAUTH][
                              EncryptionMetadata._JSON_KEY_ALGORITHM],
                      encoding=eda[
                          EncryptionMetadata._JSON_KEY_AUTH_METAAUTH][
                              EncryptionMetadata._JSON_KEY_AUTH_ENCODING],
                      message_authentication_code=eda[
                          EncryptionMetadata._JSON_KEY_AUTH_METAAUTH][
                              EncryptionMetadata._JSON_KEY_MAC],
                  )
              if (self.encryption_metadata_authentication.algorithm !=
                      EncryptionMetadata._AUTH_ALGORITHM):
                  raise RuntimeError(
                      '{}: unknown integrity/auth method: {}'.format(
                          entityname,
                          self.encryption_metadata_authentication.algorithm))
              # verify hmac
              authhmac = base64.b64decode(
                  self.encryption_metadata_authentication.
                  message_authentication_code)
              bmeta = md[EncryptionMetadata._METADATA_KEY_NAME].encode(
                  self.encryption_metadata_authentication.encoding)
              hmacsha256 = hmac.new(self._signkey, digestmod=hashlib.sha256)
              hmacsha256.update(bmeta)
              if hmacsha256.digest() != authhmac:
                  raise RuntimeError(
                      '{}: encryption metadata authentication failed'.format(
                          entityname))